Unrated severityNVD Advisory· Published Apr 17, 2025· Updated Apr 23, 2025

CVE-2025-29458

Description

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

MyBB/Mybbcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: =1.8.38

Patches

Vulnerability mechanics

References

docs.mybb.com/1.8/administration/security/protection/mitre
www.yuque.com/morysummer/vx41bz/qu7zyyxr84qno64emitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000